{"id":"GHSA-w5cr-2qhr-jqc5","aliases":[],"status":"published","title":"Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site","description":"## Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n### Root cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query parameter,  into an inline `\u003cscript\u003e` tag.\n\n### Impact\n\nAn attacker could craft a malicious link that, when clicked by a victim, would:\n- Steal user chat message history \n- Access all LLM interactions stored in the user's session.\n- Access connected MCP Servers \n- Interact with any MCP servers connected to the victim's session (public or authenticated/private), potentially allowing the attacker to perform actions on the victim's behalf\n\n### Mitigation:\n\n- PR: https://github.com/cloudflare/agents/pull/841\n- Agents-sdk users should upgrade to `agents@0.3.10`\n- Developers using `configureOAuthCallback` with custom error handling in their own applications should ensure all user-controlled input is escaped before interpolation.\n\n### Credits\n\nDisclosed responsibly by Nishant Kumawat","severity":{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-02-13T21:04:00Z","modified":"2026-02-13T21:10:51Z","fixes":[{"ecosystem":"npm","package":"agents","fixed_in":["0.3.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.10"}]}]},{"source":"osv","ecosystem":"npm","package":"agents","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.10"}]}]}],"references":[{"url":"https://github.com/cloudflare/agents/security/advisories/GHSA-w5cr-2qhr-jqc5","tags":["web"]},{"url":"https://github.com/cloudflare/agents/pull/841","tags":["web"]},{"url":"https://github.com/cloudflare/agents/commit/3f490d045844e4884db741afbb66ca1fe65d4093","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w5cr-2qhr-jqc5"},{"url":"https://github.com/cloudflare/agents","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-w5cr-2qhr-jqc5","title":"Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site","description":"## Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n### Root cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query parameter,  into an inline `\u003cscript\u003e` tag.\n\n### Impact\n\nAn attacker could craft a malicious link that, when clicked by a victim, would:\n- Steal user chat message history \n- Access all LLM interactions stored in the user's session.\n- Access connected MCP Servers \n- Interact with any MCP servers connected to the victim's session (public or authenticated/private), potentially allowing the attacker to perform actions on the victim's behalf\n\n### Mitigation:\n\n- PR: https://github.com/cloudflare/agents/pull/841\n- Agents-sdk users should upgrade to `agents@0.3.10`\n- Developers using `configureOAuthCallback` with custom error handling in their own applications should ensure all user-controlled input is escaped before interpolation.\n\n### Credits\n\nDisclosed responsibly by Nishant Kumawat","status":"published","published":"2026-02-13T21:04:00Z","modified":"2026-02-13T21:04:01Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"osv":[{"id":"GHSA-w5cr-2qhr-jqc5","title":"Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site","description":"## Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n### Root cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query parameter,  into an inline `\u003cscript\u003e` tag.\n\n### Impact\n\nAn attacker could craft a malicious link that, when clicked by a victim, would:\n- Steal user chat message history \n- Access all LLM interactions stored in the user's session.\n- Access connected MCP Servers \n- Interact with any MCP servers connected to the victim's session (public or authenticated/private), potentially allowing the attacker to perform actions on the victim's behalf\n\n### Mitigation:\n\n- PR: https://github.com/cloudflare/agents/pull/841\n- Agents-sdk users should upgrade to `agents@0.3.10`\n- Developers using `configureOAuthCallback` with custom error handling in their own applications should ensure all user-controlled input is escaped before interpolation.\n\n### Credits\n\nDisclosed responsibly by Nishant Kumawat","status":"published","published":"2026-02-13T21:04:00Z","modified":"2026-02-13T21:10:51.108736Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}